Overview

overview

10

Static

static

10

012dfec82c...18.exe

windows7-x64

10

012dfec82c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    012dfec82cf0ebd91a7da83735b95090_JaffaCakes118

  • Size

    281KB

  • Sample

    240619-3hv6ya1fkj

  • MD5

    012dfec82cf0ebd91a7da83735b95090

  • SHA1

    323895d0183ca926b70335ed53fbd62cb05663d8

  • SHA256

    78e6b084303758681831b50cb9ca5d73097c05f78fe8690ab44424e28ec49bd7

  • SHA512

    d2795d92370e874616145b73ba852ba083b92e7e8e053ff253a27bbf4b90ca4fe7bd89acdec8005485ad52b86a9eb08b316a173f4af7138c5dfaebd875fc096a

  • SSDEEP

    6144:gScrL64mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdeXijB:xc1y78QSVnNyhsFMCeSjB

Score
10/10
cybergatelatentbothackerquitopersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.18.0 - Crack Version

Botnet

hackerquito

C2

hackerquito.zapto.org:82

Mutex

DY1VH38L8V575E

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    update.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Extracted

Family

latentbot

C2

hackerquito.zapto.org

Targets

    • Target

      012dfec82cf0ebd91a7da83735b95090_JaffaCakes118

    • Size

      281KB

    • MD5

      012dfec82cf0ebd91a7da83735b95090

    • SHA1

      323895d0183ca926b70335ed53fbd62cb05663d8

    • SHA256

      78e6b084303758681831b50cb9ca5d73097c05f78fe8690ab44424e28ec49bd7

    • SHA512

      d2795d92370e874616145b73ba852ba083b92e7e8e053ff253a27bbf4b90ca4fe7bd89acdec8005485ad52b86a9eb08b316a173f4af7138c5dfaebd875fc096a

    • SSDEEP

      6144:gScrL64mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdeXijB:xc1y78QSVnNyhsFMCeSjB

    Score
    10/10
    cybergatelatentbothackerquitopersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

      trojanlatentbot

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks